secsys-fdu/cve-2025-51867
Deepfiction AI is an AI entertainment company with a mission to revolutionize personalized storytelling. Deepfiction AI provide a web application to create stories by chatting with LLM, which is vulnerable to Insecure Direct Object Reference (IDOR) in its chat component. An attacker can exploit this IDOR to chat with LLM with other users' credits.
The API endpoint https://www.deepfiction.ai/api/story/create-story-part is utilized to initiate or continue conversations. Testing indicates that this API solely relies on the treatment_id and user_id fields within the request body for access control.
It has been observed that id and author_id fields are exposed in publicly accessible conversations listed on the webpage https://www.deepfiction.ai/browse/stories. These exposed fields directly correspond to the treatment_id (mapping to id) and user_id (mapping to author_id) parameters expected by the create-story-part API.
As a result, an attacker can substitute the leaked id (as treatment_id) and author_id (as user_id) into requests to this API. This enables them to interact with the Large Language Model (LLM) by consuming the credits of other users. The figures shows the POC of this vulnerability.
Additionally, analysis of network traffic (e.g., through packet capture) can reveal the specific role configurations (character settings) for each Character. These configurations are analogous to system prompts and represent important system resources of the LLM ChatBot. This exposure also constitutes a form of sensitive data leakage, as it may reveal proprietary prompt engineering details or character definitions.
This vulnerability can have an impact on any user of https://www.deepfiction.ai. The chat credit of user will be abused with leaked treatment_id and user_id.
